Threat database

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-19966 is an authorization bypass vulnerability in CodeCanyon TimeCamp Integration for CRM versions 2.0 through 2.8. It involves improper processing of the contact_id argument in the /clients/save_contact component, allowing remote attackers to bypass authorization controls. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.3. Exploit code is publicly available, but no official patch or remediation guidance has been provided yet.

A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::applySortQuery of the file application/services/AbstractKanban.php of the component Admin Kanban Endpoint. This manipulation of the argument this causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

CVE-2026-7782 is an authorization bypass vulnerability in CodeCanyon Perfex CRM versions up to 3.4.1. It affects the Clients::project function in the Tenant Handler component, allowing remote attackers to manipulate the ID argument to bypass authorization controls. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown functionality of the component API. Executing manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Codecanyon iDentSoft 2.0. It has been classified as critical. This affects an unknown part of the file /clinica/profile/updateSetting of the component Account Setting Page. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.